CVE-2026-7415

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	Exploit Third Party Advisory
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001	Third Party Advisory
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-07 17:15

Updated : 2026-06-17 11:02

NVD link : CVE-2026-7415

Mitre link : CVE-2026-7415

CVE.ORG link : CVE-2026-7415

JSON object : View

Products Affected

yarbo

lawn_mower_firmware
lawn_mower
lawn_mower_pro_firmware
lawn_mower_pro

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-7415", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7415", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T17:04:20.271427Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@takeonme.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@takeonme.org", "affectedData": [{"vendor": "Yarbo", "product": "Firmware", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T17:15:59.570", "references": [{"url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001", "tags": ["Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@takeonme.org", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind."}], "lastModified": "2026-06-17T11:02:23.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40676938-F32C-4254-8BB6-51355E2A9B52"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "94EEF528-48EF-4892-B74A-B79B79AFC417"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BF14480-B5C0-4EF9-A9BA-81AD73B7588E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "165A0B1F-A9BD-4C58-A4CE-26C4CBCD4C21"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@takeonme.org"}